Tampered hardware wallets trigger Europe sales halt

TLDR

Reports of tampered Ledger hardware wallets have pushed major retailer MediaMarktSaturn to halt Ledger sales in Europe while investigations continue.

1. Ledger confirmed a hardware implant in devices sold via Southeast Asian reseller CryptoBilis and asked regional resellers to suspend sales.
2. MediaMarktSaturn has pulled Ledger products from stores and online across its countries as a precaution after a German customer reported a modified device.
3. The incident sharpens focus on hardware wallet supply chains, making purchase channels and anti?tampering practices as important as device cryptography.

Deep Dive

1. What Was Tampered And Where Losses Occurred

Ledgers Donjon team found an unauthorized hardware implant in at least one wallet sold by Southeast Asian reseller CryptoBilis that reads the 24?word recovery phrase during setup and transmits it over LTE using an eSIM. This attack targets the display path while leaving the secure chip and firmware unchanged, so the device can appear genuine until the seed is stolen, as detailed in Ledgers own incident explanations and CoinsKid coverage of the hardware implant capturing recovery phrases.

Independent on?chain investigators estimate suspected thefts in the range of roughly 86 million to over 100 million dollars, but Ledger has not confirmed a final figure or victim count. Crucially, all confirmed fund losses so far are tied to devices sold through CryptoBilis, and Ledger says it has no evidence that its infrastructure, direct sales, or other channels were compromised.

Confidence: high because Ledger, multiple news outlets, and on?chain analysts describe a consistent implant mechanism and scope.

2. Europe Sales Halt And Scope Of The Risk

MediaMarktSaturn, the parent company of European electronics chain MediaMarkt, has removed Ledger products from physical stores and online in all of our countries as a precaution, after a German customer reported a device with suspected hardware additions. Ledger says it coordinated this pause and that no customer fund losses have been reported in the German case, as covered in the retailers statement that MediaMarktSaturn removed Ledger products.

The halt is therefore a retailer?level, Europe?wide sales freeze for Ledger devices rather than a regulatory ban on hardware wallets. Ledger has also asked resellers in Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia, and Hong Kong to suspend sales, broadening the probe beyond CryptoBilis while reiterating that confirmed thefts remain confined to Southeast Asia, according to its request that resellers in Southeast Asia and Hong Kong halt sales.

3. Industry And User Response

Other hardware wallet makers are reacting at the distribution layer. Trezor and OneKey have revoked CryptoBilis reseller status and are tightening their reseller networks and inspections, even though they report no evidence of implants in their own devices. These changes and free replacement offers from OneKey are documented in reports on how Trezor and OneKey changed their reseller policies.

For users, the incident highlights that self?custody risk now includes supply?chain and reseller behavior. Buying directly from manufacturers, being wary of unsolicited contacts requesting a recovery phrase, and treating highly discounted or unusual retail channels with caution are becoming core parts of a safe hardware wallet setup.

Conclusion

Tampered Ledger devices show that a hardware wallets security can be undermined before it reaches the user, prompting both regional sales halts and stricter reseller controls. Confirmed thefts remain centered on Southeast Asia, while Europes MediaMarktSaturn freeze is a precautionary response to suspected implants rather than a proven fund drain. Going forward, the key signals to watch are Ledgers forensic updates, any expansion of confirmed compromised channels, and how hardware wallet makers redesign supply?chain safeguards to keep recovery phrases truly offline.